b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe
Size

820KB
MD5

8a1da33ecdcf0b67a8c758404d67d069
SHA1

8a062d78d05e2508428ba41b31e1d0b8259d48a4
SHA256

b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a
SHA512

54bb5d909e70ee99692c46b0f9cdc71242faa1025b830bc7f82e3bd864ff5cda41b1acdd46d77f594f1bd42b96addabf398e955217fc72a6b7bbecd86c573a95
SSDEEP

24576:f7Q3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:f7QbutmkO+wAOInO4XrztygxLHkJE4VB

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2784	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2792	Logo1_.exe
2264	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe

Loads dropped DLL 1 IoCs

pid	Process
2784	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Portable Devices\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre7\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Journal\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Mail\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft.NET\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\DVD Maker\es-ES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe
File created	C:\Windows\Logo1_.exe	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe
2792	Logo1_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2784	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	30
PID 3044 wrote to memory of 2784	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	30
PID 3044 wrote to memory of 2784	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	30
PID 3044 wrote to memory of 2784	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	30
PID 3044 wrote to memory of 2792	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	31
PID 3044 wrote to memory of 2792	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	31
PID 3044 wrote to memory of 2792	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	31
PID 3044 wrote to memory of 2792	3044	b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe	31
PID 2792 wrote to memory of 2740	2792	Logo1_.exe	33
PID 2792 wrote to memory of 2740	2792	Logo1_.exe	33
PID 2792 wrote to memory of 2740	2792	Logo1_.exe	33
PID 2792 wrote to memory of 2740	2792	Logo1_.exe	33
PID 2740 wrote to memory of 2756	2740	net.exe	35
PID 2740 wrote to memory of 2756	2740	net.exe	35
PID 2740 wrote to memory of 2756	2740	net.exe	35
PID 2740 wrote to memory of 2756	2740	net.exe	35
PID 2784 wrote to memory of 2264	2784	cmd.exe	36
PID 2784 wrote to memory of 2264	2784	cmd.exe	36
PID 2784 wrote to memory of 2264	2784	cmd.exe	36
PID 2784 wrote to memory of 2264	2784	cmd.exe	36
PID 2792 wrote to memory of 1204	2792	Logo1_.exe	21
PID 2792 wrote to memory of 1204	2792	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe
  "C:\Users\Admin\AppData\Local\Temp\b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a3505.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe
      "C:\Users\Admin\AppData\Local\Temp\b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2264
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
251KB

MD5
602a8e852cab5f8b3514af9d33d2edda

SHA1
b183223afdf081591839f2a7e51f43bff170e752

SHA256
783fa0bc0c23993c8c2b9f5b38a48ee8c7237dbbb6bc55d2f449e152db3005fd

SHA512
38cd1f11dca8f2c9411ccdd45639747dcc6370db4a3f2c43c22eaa83680640a664befd884e3e8c4fecdb80f577dbab12dca31d5637e316de8bd140a0b6365dbc

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
471KB

MD5
4cfdb20b04aa239d6f9e83084d5d0a77

SHA1
f22863e04cc1fd4435f785993ede165bd8245ac6

SHA256
30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9

SHA512
35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a3505.bat

Filesize
722B

MD5
a0ec8d33e6d116a3ef4a4bf73d9822ad

SHA1
bbd28f45bb4a320aeb27584b3ba3f98e074e644e

SHA256
a5b921549f9e3c06fd4ec8c8d3736f307c5a011f2f92286d776ebcb697c59b5d

SHA512
91dd794ed87b7c53497a6de017a12790bb60bb95e98a630b11c59d3a0a5c9f25927287113937bf5b1ed88b854846dc23264ebc53c044c52bf9283592181f35c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6c487a143ebaee222cdf964a80757259ad3fdf2c20e03081b49b7dc496a170a.exe.exe

Filesize
794KB

MD5
c6d0721e9156eb2a40a04bb38be0b2a5

SHA1
d0a3fcb3ad9f227a02d30abb767883b42fecc3a7

SHA256
2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d

SHA512
e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4

Download Submit
C:\Windows\Logo1_.exe

Filesize
26KB

MD5
597dce3317f57eaac044ce19db3307f6

SHA1
665fde09122f6c76187190e8efa73db75c51e642

SHA256
170d6e27f17394d79f717570b49b94ae0d533b65219dfee4d0e047a5e7690b32

SHA512
a6a417d61b1040b3f63d1ca484b3d3c57e7850f29762e8ade063ba860e369cc91e0f4a82eaeb5bca63531b56cd37a909662445dc6bd8564dedb7de6ef4330a53

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\_desktop.ini

Filesize
9B

MD5
475984718232cf008bb73666d834f1f4

SHA1
12f23c9301c222f599a279e02a811d274d0f4abc

SHA256
a5b32591119f87eb3c8a00c0c39e26ea6d6414aa9887d85fcb4903e1c14921b5

SHA512
80235dc2560b7991d79f9550cdeca6ac02c00cee6bf186f8f20d4ff3fbd7718be937b73ab768d71c4027e153557b08bbfd95ea88d2e0857a7c70cf1da6fa9937

Download Submit
memory/1204-32-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2792-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-93-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-1876-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-3336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3044-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3044-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download